PT-2026-27783

Name of the Vulnerable Software and Affected Versions pdf-image versions through 2.0.0 Description The pdf-image npm package versions through 2.0.0 allows for OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions utilize...

Allocation of Resources Without Limits or Throttling

Overview @astrojs/node is a Deploy your site to a Node.js server Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the /server-islands/name route handler, which buffers and parses the entire request body as JSON without enforcing a size...

EUVD-2026-14962

Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands...

CVE-2026-29772 Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands

Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because JSON.parse allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achiev...

CVE-2026-29772

Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because JSON.parse allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achiev...

CVE-2026-33334

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables nodeIntegration in the renderer process without contextIsolation or sandbox. This means any cross-site scripting XSS vulnerability in...

CVE-2026-33336

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables nodeIntegration in the main BrowserWindow and does not restrict same-window navigations. An attacker who can place a link in...

Exploit for CVE-2026-26832

CVE-2026-26832: OS command injection in node-tesseract-ocr...

Exploit for CVE-2026-26830

CVE-2026-26830: OS command injection in pdf-image Summary...

MAL-2026-2398 Malicious code in xrpl-hooks-ide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cba4a53598147b0ea4a05d573906166d018f6026d4b245512f651c235c2bae3 The package xrpl-hooks-ide was found to contain malicious code...

MAL-2026-2397 Malicious code in wraith-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e01edc3106b7a83dd7050b7ade8ef141a38fac23b8829ed8d2f4e1f1402829b The package wraith-module was found to contain malicious code...

Malicious code in voodoo-internal-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a66c21f000ea33496a8cd95744872d47bbd617d4a4cabdae400ae0361cf0faf3 The package voodoo-internal-api was found to contain malicious code...

MAL-2026-2396 Malicious code in voodoo-internal-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a66c21f000ea33496a8cd95744872d47bbd617d4a4cabdae400ae0361cf0faf3 The package voodoo-internal-api was found to contain malicious code...

MAL-2026-2395 Malicious code in uuidvalidatorarabis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 980bd443f5ff6b9b9a38a084ed533ef47f42bf5867df5d6281df19515171a6a9 The package uuidvalidatorarabis was found to contain malicious code...

Malicious code in uuidvalidatorarabis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 980bd443f5ff6b9b9a38a084ed533ef47f42bf5867df5d6281df19515171a6a9 The package uuidvalidatorarabis was found to contain malicious code...

Malicious code in typescript-mock-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1a51f9143ac378f3ef81840f6858a902bd37449fa9b93b0999e021321ddafac The package typescript-mock-data was found to contain malicious code...

Malicious code in this-is-my-test-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d72a917ddcec635fc210d8767a9c289b6d43128c589de76fe7c0548da33878d2 The package this-is-my-test-package was found to contain malicious code...

Malicious code in stormbreaker-shade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c845d690b6091601683bf61bdd858e5579c2fd4d33b770806b1bb113e9533f1 The package stormbreaker-shade was found to contain malicious code...

MAL-2026-2391 Malicious code in ssr-catalogue-sfcc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffd2663232d7c5508f63c063736d09a7c1fdfefe9783f5941c9214f687df7fb The package ssr-catalogue-sfcc was found to contain malicious code...

Malicious code in ssr-catalogue-sfcc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffd2663232d7c5508f63c063736d09a7c1fdfefe9783f5941c9214f687df7fb The package ssr-catalogue-sfcc was found to contain malicious code...